← Vulnerability feed

Vulnerability record · CVE-2014-3600 · published 27 October 2017

CVE-2014-3600: Apache activemq xml external entity (xxe) vulnerability

Apache · Activemq

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

9.8 CVSS 3.0 Critical EPSS 9.7% · top 4.6% CWE-611 · XML external entity (XXE)
9.8CVSS 3.0 base score, v2 7.5
9.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt Vendor Advisory
http://seclists.org/oss-sec/2015/q1/427 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/72510 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722 Third Party AdvisoryVDB Entry
https://issues.apache.org/jira/browse/AMQ-5333 Issue TrackingThird Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apac
http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt Vendor Advisory
http://seclists.org/oss-sec/2015/q1/427 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/72510 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722 Third Party AdvisoryVDB Entry
https://issues.apache.org/jira/browse/AMQ-5333 Issue TrackingThird Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apac

Track CVE-2014-3600 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-46604Apache ActiveMQ OpenWire deserialization remote code executionThe Java OpenWire protocol marshaller in Apache ActiveMQ deserializes untrusted data, letting an attacker manipulate serialized class types so the br…KEVEPSS 100%analysed9.8CVE-2016-3088Apache ActiveMQ Fileserver unrestricted file upload to RCEThe Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 accepts HTTP PUT uploads and HTTP MOVE requests without adequate validation, lett…KEVEPSS 99%analysed8.8CVE-2026-34197Apache ActiveMQ Jolokia JMX bridge code injection via broker config URIApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default policy that allows exec operations on all org.apache.acti…KEVEPSS 15%analysed9.9CVE-2021-21345XStream deserialization allows remote command executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, allowing code injection and OS command execution. The flaw is a …EPSS 72%analysed9.8CVE-2021-21347Netapp oncommand insight unrestricted file upload vulnerabilityXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re…EPSS 14%9.8CVE-2021-21350Netapp oncommand insight unrestricted file upload vulnerabilityXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re…EPSS 15%9.8CVE-2021-21344XStream deserialization allows remote code executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker craft a stream that loads and executes…EPSS 76%analysed9.8CVE-2021-21346XStream deserialization allows remote code executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker load and execute arbitrary code by man…EPSS 76%analysed

Source: NIST National Vulnerability Database (record CVE-2014-3600), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.